YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 9bbd5857a2f00ef245ec400c8f527e666351d325938be7816a97dcc879df3507.

Scan Results

SHA256 hash: 9bbd5857a2f00ef245ec400c8f527e666351d325938be7816a97dcc879df3507
File size:4'772'827 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 1ef394cec9cefc0ff8a7c82a10f87c68
SHA1 hash: 4b6b65c555db0d0b2201f18822dc41122146ad7f
SHA3-384 hash: 96acdb860d0fdd55097e933c465aa89b2f47132700f9cde6ff25d36845eb6aba4f52ec6a4eda72357edada47a0ff33c1
First seen:2026-04-27 14:43:48 UTC
Last seen:Never
Sightings:1
imphash : 05a03ed18d2e75f8c4f1c5bcf287ac56
Create hunting rule
ssdeep : 98304:/UyHQcsibw8SPLeTtSQo5Z8DERxrfExYzQ/Fdd7cwpy4V:MywcXMHLKy6txfHdoAy2
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : c6c2ccc4f4e0e0f8
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:802876ba-4247-11f1-badc-42010aa4000b
File name:1ef394cec9cefc0ff8a7c82a10f87c68
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Trojan.Surveyer.160.14916.UNOFFICIAL
Create hunting rule
Signature:Win.Malware.Generic-6651517-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
TLP:TLP:WHITE
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify
Rule name:classified
Author:classified
Description:classified
Reference:classified
TLP :TLP:AMBER
Rule name:pe_detect_tls_callbacks
Create hunting rule
Author:
TLP:TLP:WHITE
Repository:YARAify
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
TLP:TLP:WHITE
Repository:bartblaze
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.